|
Nov 09
2009
|
Apple’s iPhone Gets First WormPosted by meggebrecht in Sophos, Jailbreaking, iPhone, Apple |
Apple's iPhone has its first reported worm, though it affects only jailbroken devices and, thus far, Australians.
At least 100 iPhones have been infected with the worm, which replaces the device's wallpaper with an image of 1980s one-hit wonder Rick Astley -- who, thanks to the rickrolling phenomenon, has seen his pop culture status reach new heights over the last couple years.
Security vendor Sophos reported the worm on Nov. 8, and explained that after switching the iPhone background with Astley's picture and the message "ikee is never going to give you up," the worm attempts to spread to other iPhones on the network. But the only users at risk are those who have "liberated" their phones and are running the SSH (secure shell) application with the default password -- "alpine."
Sophos identified the ikee worm creator as Ashley Towns, a 21-year-old student in New South Wales, and said that the worm appears not to have traveled out of Australia at this point.
On his blog, Graham Cluely, senior technology consultant at Sophos, noted that "the source code is littered with comments from the author suggesting the worm has been written as an experiment. One of the comments berates affected users for not following instructions when installing SSH, because if they had changed the default password the worm would not have been able to infect them."
In an interview with ABC News, Towns said he created the program to draw attention to security issues. When users jailkbreak their phones and install the SSH service, they need to change the password, he said, adding that "somebody with more malicious intent could have done anything -- read your SMSs, go through your e-mails, view your contacts, photos -- anything."
Towns' program may have been relatively benign, but he has released the full source code, meaning that more dangerous variants are likely to follow. "A more malicious hacker could take the code written by ikee and adapt it to have a more sinister payload," said Cluely.
Though the company was probably seething internally, Apple until earlier this year had remained mum on jailbreaking, or hacking the iPhone so that it can run unsanctioned third-party apps. It has recently come down hard on the practice, claiming that, among other things, jailbroken phones could be used to bring down a cell phone tower. Apple is reportedly looking for a security manager for the iPhone platform, to harden security and prevent jailbreaking.
For businesses, jailbroken phones present a real threat, since the practice can allow potentially dangerous applications to enter the enterprise. "Businesses ... need to ensure that they don't have staff who are endangering corporate data by running insecure smartphones," Cluely told V3.co.uk.
At the very least, the ikee worm should help remind people to exercise some common sense when it comes to password practices.





